Back to guides list

Important kernel security update: Virtuozzo ReadyKernel patch 117.0 for Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform 3.0, and Virtuozzo Hybrid Infrastructure 3.5, 4.0

Issue date: 2020-10-09

Applies to: Virtuozzo Hybrid Infrastructure 3.5, Virtuozzo Hybrid Infrastructure 4.0, Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform 3.0

Virtuozzo Advisory ID: VZA-2020-064

1. Overview

The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.0, Virtuozzo Infrastructure Platform, and Virtuozzo Hybrid Infrastructure. <b>IMPORTANT:</b> If bcache is used, manually unloading this or a newer ReadyKernel update while bcache is writing dirty data to the backing device may sometimes create a memory leak. Updating the ReadyKernel patch is not affected. To manually unload the patch, first disable caching temporarily or wait until the cache becomes clean.

2. Security Fixes

  • [Important] [3.10.0-1127.8.2.vz7.158.8] The metadata validator in XFS may flag an inode with a valid extended attribute as corrupt. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. (CVE-2020-14385)

  • [Moderate] [3.10.0-957.10.1.vz7.85.17 to 3.10.0-1127.8.2.vz7.158.8] netfilter/ipset: excessive memory consumption leading to a denial of service. If was discovered that not all memory allocated for ipset-related data was properly accounted for. An attacker could exploit it from a container to consume lots of kernel memory, making the host system unusable (denial of service). (PSBM-108091)

  • [Moderate] [3.10.0-1127.8.2.vz7.158.8] NFS v4: potential memory corruption on the client system when processing security attributes. It was discovered that a buffer overflow and memory corruption were possible if a system tried to mount an NFS v4 share where the files had security labels in the file attributes. An attacker would need to control the NFS server and make it send a specific series of responses to trigger the issue. The issue allows the attacker to crash the kernel on the client system or, potentially, escalate their privileges there. (CVE-2020-25212)

  • [Moderate] [3.10.0-1127.8.2.vz7.158.8] netfilter: kernel crash due to a buffer overflow in ctnetlink_parse_tuple_filter(). It was discovered that a local attacker could pass a specially crafted configuration of conntrack to the kernel to cause a buffer overflow in ctnetlink_parse_tuple_filter() function. As a result, the kernel could crash. (CVE-2020-25211)

3. Bug Fixes

  • [3.10.0-957.10.1.vz7.85.17 to 3.10.0-1127.8.2.vz7.158.8] bcache: Potential kernel crash when using RAID1 as a backing device. (PSBM-106785)

  • [3.10.0-957.10.1.vz7.85.17 to 3.10.0-1127.8.2.vz7.158.8] ploop: Potential kernel crash or data corruption during backups due to racy operations with lockout data. (PSBM-108276)

4. Installing the Update

Download, install, and immediately apply the patch to the current kernel by running ‘readykernel update’.

Nov 18, 2024
Edit Print